            {:method "GET"
             :path (str "/" path)
             :query-string query-str
-            :headers {"host" (str bucket ".s3." region ".amazonaws.com")}
+            :headers (cond-> {"host" (str bucket ".s3." region ".amazonaws.com")}
+                       ?security-token
+                       (assoc "x-amz-security-token" ?security-token))
             :body nil})]
          (string/join "\n")
          aws/str->bytes


(defn- get-signature
  [{:aws/keys [credentials-provider] region :aws-region bucket :aws-bucket :as config} utc-now path query-str]
  (let [[_ api-secret] (credentials-provider)]
    (->> ["AWS4-HMAC-SHA256"
          (.format utc-now aws/basic-date-time-format)
          (string/join "/" [(.format utc-now aws/basic-date-format) region "s3"

                                    :aws-region region}))
        (cond->
            ?session-token
          (assoc-in [:headers "x-amz-security-token"] ?session-token)))))



